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America  relies  on  our  digital  infrastructure 
daily,  and  protecting  this  strategic  asset 
is  a  national  security  priority. 

— President  Barack  Obama,  2010 


SecLirity  in  cyberspace  is  a  clear  na¬ 
tional  priority,  but  the  role  of  the  US 
military  in  this  new  domain  is  not  so 
clear.  With  the  activation  of  US  Cyber  Com¬ 
mand  in  2010,  debate  concerning  the  milita¬ 
rization  of  cyberspace  and  the  conduct  of 
cyber  "warfare”  has  taken  center  stage  among 
US  government  policy  makers.1  Complicat¬ 
ing  matters  is  the  uncertain  practice  of  gov¬ 
erning  behavior  in  cyberspace  by  applying 
domestic  legal  and  policy  guidelines  as  well 
as  international  treaties  based  on  kinetic 
warfare.2  Despite  this  uncertainty,  Depart¬ 
ment  of  Defense  (DOD)  policy  requires  that 
DOD  components  "comply  with  the  law  of 
war  during  all  armed  conflicts,  however 
such  conflicts  are  characterized,  and  in  all 
other  military  operations.”3  Although  it  re¬ 
mains  to  be  seen  what  roles  and  responsi¬ 
bilities  policy  makers  in  Washington,  DC, 
will  carve  out  for  the  military,  the  DOD 
should  prepare  to  conduct  military  opera¬ 
tions  in  the  cyber  domain.  To  do  so  effec¬ 
tively,  the  department  should  apply,  with 
slight  modification,  time-tested  joint  target¬ 
ing  principles  to  military  operations  in 
cyberspaced  This  article  explores  the  effi¬ 
cacy  of  Joint  Publication  (JP)  3-60,  Joint  Tar¬ 
geting,  as  applied  to  military  operations  in 
cyberspace  and  proposes  recommendations 
for  joint  targeting  doctrine  for  cyberspace.5 
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Foundational  Principles 
of  Joint  Targeting 

Before  we  can  address  the  adequacy  of 
applying  JP  3-60  to  cyber  targeting,  we 
must  understand  the  foundations  of  its 
principles,  the  reason  for  its  application, 
and  the  relationship  between  doctrine  and 
law.  “Joint  doctrine  presents  fundamental 
principles  that  guide  the  employment  of 
US  military  forces,"  and  "[commanders]  at 
all  levels  [must]  ensure  their  forces  operate 
in  accordance  with  the  'law  of  war,'  ”  which 
is  "binding  on  the  United  States.”6  Joint 
doctrine  incorporates  what  the  United 
States  has  agreed  to  follow  in  international 
law  as  well  as  operational  best  practices. 
The  "law  of  war”  consists  of  conventional 
international  law  (treaties  and  agreements 
between  nation-states)  and  customary 
international  law  (based  on  state  practice).7 
The  latter  develops  from  state  practice  — 
namely,  official  governmental  conduct  re¬ 
flected  in  a  variety  of  acts,  including  pub¬ 
lished  doctrine.  Thus,  joint  doctrine  not 
only  reinforces  binding  legal  obligations 
but  also  advances  the  development  of  cus¬ 
tomary  international  law. 

For  simplicity,  the  primary  canons  that 
set  the  foundation  for  the  modern  law  of 
war  are  divided  between  rules  for  the  con¬ 
duct  of  war  and  the  treatment  of  parties  to 
the  conflict  and  its  bystanders:  the  Hague 
and  the  Geneva  conventions,  respectively.8 
Additionally,  the  Charter  of  the  United  Na¬ 
tions  outlines  obligations  of  the  organiza¬ 
tion's  member  states  with  regard  to  the  "use 
of  force”  against  other  states.9  Domestic  law 
(federal  statutes  and  judicial  decisions),  US 
government  policy,  joint  and  service  doc¬ 
trine,  as  well  as  rules  of  engagement  (ROE) 
specify  how  US  military  forces  will  comply 
with  these  international  obligations.  We 
must  understand  that  neither  military  doc¬ 
trine  nor  ROEs,  whether  standing  or  mis¬ 
sion  specific,  replace  or  supersede  the  laws 
of  war.  Rather,  they  represent  US  imple¬ 
mentation  of  agreed-upon  international 
principles  to  a  specific  situation. 


We  can  distill  this  vast  body  of  rules,  regu¬ 
lations,  and  doctrine  to  five  simple  principles 
that  apply  to  any  specific  operation.  First, 
the  use  of  force  presupposes  the  existence 
of  military  necessity  (a  valid  military  reason 
to  use  force  necessary  to  carry  out  the  mis¬ 
sion).10  Second,  the  proposed  employment 
of  force  must  not  cause  the  civilian  popula¬ 
tion  or  the  targeted  enemy  force  unneces¬ 
sary  suffering.11  Commanders  must  apply 
this  principle— the  basis  for  later  conven¬ 
tions  that  outlaw  certain  types  of  weapons 
and  munitions  (e.g.,  chemical  weapons)— 
not  only  to  potential  "collateral  damage” 
(incidental  loss  of  civilian  life  or  damage  to 
civilian  property)  but  also  to  the  intended 
object  of  attack.  Third,  the  employment  of 
force  must  discriminate  or  distinguish  be¬ 
tween  combatants  and  noncombatants  as 
well  as  forgo  intentional  attacks  against  ci¬ 
vilian  populations  not  directly  participating 
in  hostilities.12  In  short,  the  operator  must 
use  a  weapon  capable  of  being  aimed  and 
must  distinguish  between  civilians  and  ad¬ 
versaries— the  underlying  principle  that 
guides  joint  targeting  analysis,  explored  in 
greater  detail  below.  Fourth,  the  proposed 
military  operation  must  be  proportional— 
that  is,  it  must  avoid  excessive  collateral 
damage  in  light  of  the  expected  military  ad¬ 
vantage.13  Finally,  the  parties  in  the  armed 
conflict  must  maintain  chivalry  or  a  "certain 
amount  of  fairness  .  .  .  and  a  degree  of  mu¬ 
tual  respect  and  trust.”14  Applying  these 
principles  guides  the  employment  of  force 
in  general  and  individual  targeting  deci¬ 
sions  in  particular. 

In  military  circles,  the  term  targeting  of¬ 
ten  describes  an  action  of  a  military  force 
engaging,  or  preparing  to  engage,  an  ad¬ 
versary.  Officially,  joint  doctrine  defines 
targeting  as  "the  process  of  selecting  and 
prioritizing  targets  and  matching  the  appro¬ 
priate  response  to  them,  considering  opera¬ 
tional  requirements  and  capabilities."15 
This  definition— specifically,  the  process  of 
selecting  the  target  and  matching  the  ap¬ 
propriate  response  to  it— most  directly  en¬ 
tails  obligations  under  the  law  of  war.  Tar¬ 
get  selection  is  the  primary  premise  upon 
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which  the  principle  of  discrimination  rests. 
Military  objects  are  lawful  targets,  but 
forces  should  not  attack  civilians  intention¬ 
ally  and  should  spare  them  from  collateral 
effects  as  much  as  possible.16  Therefore,  the 
law  of  war  holds  the  military  commander 
and  operator  responsible  for  identifying, 
functionally  characterizing,  and  attribut¬ 
ing  to  a  combatant— as  accurately  as  practi¬ 
cable— the  intended  object  of  a  proposed 
military  operation. 

Military  doctrine  sets  forth  principles  to 
guide  forces  in  carrying  out  their  obligation 
of  discrimination.  JP  3-60  includes  the  over¬ 
arching  targeting  principles  for  conducting 
combined  or  joint  operations.  Military  ser¬ 
vice  doctrine,  such  as  Air  Force  Doctrine 
Document  (AFDD)  2-1.9,  Targeting,  comple¬ 
ments  joint  doctrine  with  principles  specifi¬ 
cally  designed  for  the  individual  service's 
primary  responsibility.17  These  principles 
derive  from  best  practices,  drawing  on  the 
collective  experience  of  the  US  military  and 
its  allies  during  previous  military  cam¬ 
paigns  and  operations.  Because  no  military 
service  has  primary  responsibility  for  the 
cyberspace  domain  and  because  little,  if 
any,  collective  best  practice  for  military  op¬ 
erations  in  cyberspace  exists,  current  doc¬ 
trine  for  other  war-fighting  domains  shapes 
cyber  operation  planning  and  informs  cyber 
targeting  decisions.18  Therefore,  JP  3-60  is 
by  default  the  current  foundational  publica¬ 
tion  on  joint  targeting  in  cyberspace. 

Application  to  Cyberspace 

Applying  existing  military  doctrine  (spe¬ 
cifically,  targeting  and  law-of-war  principles) 
to  operations  in  cyberspace  is  easy  in  theory 
but  may  prove  extremely  difficult  in  prac¬ 
tice.  Cyber  warfare  differs  fundamentally 
from  traditional  armed  conflict.  Unlike  the 
conduct  of  past  warfare,  opponents  (includ¬ 
ing  state  actors,  criminals,  terrorists,  and 
hackers)  can  wage  cyber  warfare  from  far 
reaches  of  the  globe  rapidly,  cheaply,  anony¬ 
mously,  and  devastatingly.  Current  military 
doctrine  looks  to  the  experiences  and  theo¬ 


ries  of  kinetic  warfare  between  nation-states 
in  battlespaces  that  exist  almost  exclusively 
in  a  physically  recognizable  and  under¬ 
standable  area  (air,  land,  sea,  and  space). 
Cyber  warfare,  by  contrast,  occurs  in  "a 
realm  located  simultaneously  at  logical  and 
physical  layers  that  intersects  activities  in, 
through,  and  concerning  the  electromagnetic 
spectrum  which  seamlessly  crosses  other 
domains  as  well  as  geographic  and  recog¬ 
nized  political  boundaries.”19 

The  extent  to  which  cyber  warfare  differs 
from  kinetic  warfare  and  represents  a  para¬ 
digm  shift  in  modern  military  affairs  is  a 
contentious  subject  best  suited  to  academic 
historians.  However,  differences  exist  be¬ 
tween  the  actors  and  the  means/methods  of 
armed  conflict  in  the  physical  world  and 
their  counterparts  associated  with  conflicts 
in  cyberspace.  These  variations  illustrate 
the  complex  challenges  of  applying  current 
law,  policy,  and  military  doctrine  to  key¬ 
strokes  and  mouse  clicks. 

First,  participation  in  cyber  warfare  is 
not  limited  to  agents  of  the  nation-state.  Un¬ 
like  conventional  military  attack,  conduct¬ 
ing  a  strike  in  cyberspace  does  not  require 
government  sponsorship.20  Second,  the  at¬ 
tacker  does  not  need  expensive,  traditional 
weapon  systems— only  a  computer,  an  In¬ 
ternet  connection,  and  basic  cyber  exper¬ 
tise.21  Third,  unlike  attributing  an  attack  in 
the  kinetic  world,  identifying  the  source  of 
a  cyber  strike  is  extremely  difficult.  For  ex¬ 
ample,  finding  the  aggressor  nation  respon¬ 
sible  for  a  missile  attack  is  relatively  easy 
because  key  “fingerprints”  such  as  the  mis¬ 
sile’s  size,  speed,  range,  and  type  of  war¬ 
head  point  to  a  relatively  small  list  of  coun¬ 
tries  that  have  the  technology,  will,  and 
expertise  to  conduct  such  an  attack.  A  cyber 
attack,  however,  can  originate  from  any¬ 
where  and  with  anyone,  including  state- 
sponsored  "hacktivists,  ”  nonstate  actors,  or 
"free  lancers  packing  a  politically  motivated 
laptop  punch."22 

The  key  differences  between  cyber  war¬ 
fare  and  its  kinetic  cousin  raise  pertinent 
questions.  First,  is  it  realistic  to  expect 
even  state-sponsored  cyber  operators  to 
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comply  with  legal  principles  and  military 
doctrine  based  on  traditional  notions  of 
kinetic  war  in  this  new  domain?  Second, 
do  we  need  a  new  joint  publication  specifi¬ 
cally  dedicated  to  cyberspace  targeting  to 
account  for  these  differences? 

Despite  disparities  in  the  operational  do¬ 
mains,  cyber  warriors  are  fundamentally 
the  same  as  their  counterparts  on  land,  at 
sea,  and  in  the  air.  Both  rely  upon  their 
knowledge  of  the  domain,  operational  envi¬ 
ronment,  and  weapon  system  capabilities. 
The  complexity  of  war  fighting  resists  any 
attempt  to  reduce  it  to  a  formulaic  checklist 
for  commanders.  Astute  leaders  may  dis¬ 
cern  and  apply  enduring  truths  of  war,  in¬ 
cluding  the  framework  for  its  legal  use, 
within  the  context  of  a  particular  opera¬ 
tional  or  strategic  environment.  With  a  few 
modifications,  cyber  operators  can  apply 
legal  principles  and  military  doctrine  based 
on  traditional  kinetic  warfare  to  cyber  op¬ 
erations  and  still  produce  the  intended  ef¬ 
fects.  Similarly,  with  only  slight  adjust¬ 
ments  for  cyber  nuances,  JP  3-60  can 
continue  to  serve  as  the  US  military’s  foun¬ 
dational  publication  for  both  kinetic  and 
nonkinetic  targeting. 

Military  Doctrine  in  Cyberspace 

In  the  recent  past,  only  one  joint  publica¬ 
tion  concerned  itself  exclusively  with  con¬ 
ducting  military  operations  in  the  cyber  do¬ 
main.23  JP  3-13,  Information  Operations, 
identified  information  operations  (IO)  as 
"the  integrated  employment  of  electronic 
warfare  (EW),  computer  network  operations 
(CNO),  psychological  operations  (PSYOP), 
military  deception  (MILDEC),  and  opera¬ 
tions  security  (OPSEC),  in  concert  with 
specified  supporting  and  related  capabili¬ 
ties,  to  influence,  disrupt,  corrupt  or  usurp 
adversarial  human  and  automated  decision 
making  while  protecting  our  own.”24  Doc- 
trinally,  CNO,  including  computer  network 
attack  (CNA)  and  defense  (CND),  repre¬ 
sented  just  a  subset  of  a  larger  category  of 
arguably  dissimilar  activities.  Doctrine  as¬ 


serted  the  centrality  of  these  capabilities  to 
IO  as  a  whole,  noting  that  they  would  help 
the  joint  force  commander  influence  an  ad¬ 
versary.  But  grouping  them  together  sug¬ 
gested  that  IO  itself  is  a  war-fighting  spe¬ 
cialty  capable  of  rapid  integration  into  a 
joint  task  force.  Unfortunately,  this  is  not 
the  way  the  services  train  their  personnel. 
Rather,  they  currently  train  an  individual  in 
one  or  two  competencies,  such  as  EW  or 
PSYOP.  Within  CNO,  only  rarely  does  a  per¬ 
son  have  both  CNA  and  CND  proficiency. 
Therefore,  an  IO  cell  at  the  joint  task  force 
level  may  be  composed  of  "cylinders  of  ex¬ 
cellence”  (i.e.,  individuals  well  versed  in 
their  narrow  field  of  training  but  possessing 
little  understanding  of  the  other  capabili¬ 
ties).  This  is  particularly  true  with  regard  to 
the  concept  of  targeting:  JP  3-13  does  not 
contain  guidance  on  the  topic. 

Assuming  the  "core”  nature  of  these  ca¬ 
pabilities,  why  does  JP  3-13  include  no  in¬ 
struction  on  targeting?  Three  reasons  come 
to  mind.  First,  targeting  is  so  essential  to 
war  fighting  that  nearly  every  military 
member  has  a  general  understanding  of  the 
concept.  However,  targeting  that  success¬ 
fully  attains  both  military  and  political  ob¬ 
jectives  is  an  extremely  complex  process 
that  relatively  few  individuals  have  mastered. 
Simply  put,  most  military  professionals 
know  what  targeting  means,  but  few  of 
them  know  how  to  do  it.  Second,  JP  3-13 
does  not  address  the  specifics  of  core  capa¬ 
bilities.  Rather,  it  refers  the  IO  planner  to 
other  publications  for  guidance,  suggesting 
that  these  capabilities  are  not  as  closely 
linked  as  JP  3-13  asserts.  Instead,  in  the 
minds  of  conventional  military  planners, 
they  are  merely  several  unique,  unconven¬ 
tional  military  activities  difficult  to  inte¬ 
grate  into  an  operations  plan.  Finally,  many 
planners  believe  that  "targeting  is  target¬ 
ing,”  no  matter  the  platform  or  domain. 

Most  cyber  operational  planners  would 
declare  that  they  understand  the  general 
concept  of  targeting  as  contemplated  in  the 
official  doctrinal  definition  and  as  outlined 
in  JP  3-60.  However,  their  application  of  the 
concept  and  definition  to  their  core  IO  ca- 
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pability  may  mean  something  very  differ¬ 
ent.  For  example,  a  proposed  PSYOP  activity 
might  "target”  a  foreign  audience  whose  be¬ 
havior  and  actions  targeteers  want  to  influ¬ 
ence,  but  an  EW  operation  might  target  sig¬ 
nals  from  a  radio  tower.  JP  3-13  suggests 
that  the  five  types  of  IO  functions  listed 
above  are  operationally  interrelated  yet  of¬ 
fers  no  guidance  on  how  to  target  the  adver¬ 
sary  using  these  functions  specifically.25 
The  IO  planner  or  operator  must  then  refer 
to  another  subject-matter-specific  publica¬ 
tion  for  guidance.26  The  fact  that  JP  3-13 
represents  the  only  joint  guidance  on  net¬ 
work  operations  complicates  matters  for  the 
CNO  planner.27  Thus,  CNO  planners  at  the 
joint  level  must  often  look  backward  to  ser¬ 
vice  doctrine  for  such  guidance. 

The  Air  Force  recently  released  AFDD 
3-12,  Cyberspace  Operations,  which  differen¬ 
tiates  between  cyber  and  information  op¬ 
erations.28  This  document  represents  the 
service's  best  effort  to  understand,  organize, 
train,  and  guide  Airmen  in  cyberspace  op¬ 
erations.  Basic  enough  for  the  cyber  novice 
yet  comprehensive  enough  for  the  expert, 
AFDD  3-12  provides  technically  sound  and 
operationally  relevant  guidance  to  Airmen 
in  the  absence  of  guidance  at  the  joint 
level— a  particularly  remarkable  feat.  Even 
more  impressive,  the  document  relates 
principles  of  joint  operations  to  cyberspace 
operations,  offering  input  across  the  range 
of  military  operations  and  outlining  funda¬ 
mental  principles  for  the  Air  Force  cyber 
warrior.29  Arguably,  AFDD  3-12  is  the  most 
comprehensive  document  on  cyber  opera¬ 
tions  in  the  DOD;  indeed,  the  joint  force 
would  be  well  served  by  a  joint  publication 
having  its  breadth  and  depth.  Admittedly,  even 
though  AFDD  3-12  discusses  many  issues 
useful  in  cyber  targeting,  such  as  technical 
relationships  in  cyberspace  infrastructure, 
information  assurance,  compressed  deci¬ 
sion  cycles,  and  the  anonymity  and  attribu¬ 
tion  challenge,  it  does  not  specifically  ad¬ 
dress  cyber  targeting  per  se.30  In  fact,  the 
document  refers  readers  to  JP  3-60,  suggest¬ 
ing  that  the  joint  publication’s  principles, 


guidance,  and  theory  properly  apply  to  Air 
Force  operations  in  cyberspace. 

On  the  one  hand,  the  subject  of  targeting 
seldom  appears  in  current  DOD,  joint,  or 
service  doctrine  on  cyberspace,  perhaps  be¬ 
cause  the  military  has  only  now  begun  for¬ 
mally  organizing  its  cyber  forces  or  because 
the  services  do  not  have  a  large,  collective 
cyber-targeting  experience  from  which  to 
draw.31  On  the  other  hand,  DOD  leaders 
may  simply  believe  that  JP  3-60's  principles 
of  targeting  are  so  sound  that  they  translate 
easily  to  military  operations  in  the  cyber 
domain.  Whatever  the  rationale,  JP  3-60  re¬ 
mains  the  seminal  joint  publication  on  tar¬ 
geting  in  cyberspace  despite  the  fact  that  it 
makes  no  reference  to  the  domain  itself. 


Review  of  Joint  Publication  3-60 

Organized  in  three  main  sections— funda¬ 
mentals  of  targeting,  the  joint  targeting  pro¬ 
cess,  and  duties  and  responsibilities— JP 
3-60  proceeds  logically  from  defining  the 
term  target ;  through  target  development, 
target  engagement,  and  damage  assess¬ 
ment;  to  command  responsibilities  and 
oversight.  A  targeting  novice  can  quickly 
grasp  the  fundamentals  of  this  concise, 
well-written  document.  For  example,  one 
simple  chart  (fig.  II-l,  the  Joint  Targeting 
Cycle)  conveys  the  essence  of  combat  tar¬ 
geting.32  lb  understand  the  cycle  is  to 
understand  targeting. 

The  joint  targeting  cycle  quickly  out¬ 
lines  the  who,  what,  where,  when,  why, 
and  how  of  adversary  engagement.33  After 
the  joint  force  commander  announces  an 
end  state  and  objective,  planners  develop  and 
prioritize  targets  toward  that  end.  Tbrget  se¬ 
lection  drives  weapon/ capability  pairing, 
which  ensures  successful  engagement 
while  minimizing  collateral  damage.  The 
particular  weapon  selected  determines 
force  assignment,  which  informs  mission 
planning  and  drives  execution,  after  which 
an  assessment  tells  the  commander 
whether  the  mission  has  fulfilled  the  ob¬ 
jectives  or  whether  additional  targeting  is 
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necessary,  as  determined  through  evalua¬ 
tion  of  predetermined  measures  of  effec¬ 
tiveness  and  measures  of  performance. 
Skipping  steps  in  the  cycle  jeopardizes 
mission  effectiveness;  adding  steps  outside 
the  cycle  is  superfluous.  From  a  legal  per¬ 
spective,  adherence  to  the  joint  targeting 
cycle  process  and  to  other  fundamental 
principles  in  the  publication,  coupled  with 
sound  command  judgment,  virtually  as¬ 
sures  compliance  with  the  laws  of  war. 

Thus,  JP  3-60  appears  to  be  a  "plug  and 
play”  guidebook  for  targeting  in  any  domain. 
Unfortunately,  analysis  which  assumes  that 
the  cyber  domain  shares  essentially  the 
same  characteristics  with  air,  land,  sea,  and 
space  fails  to  account  for  its  uniqueness. 

Like  the  other  domains,  cyberspace  occu¬ 
pies  an  area,  is  subject  to  exploitation  by 
governments  and  entrepreneurs,  and  serves 
as  a  medium  for  the  exchange  of  commerce 
among  corporations,  nations,  and  individuals. 
Yet  this  unique  medium  "has  to  be  appreci¬ 
ated  on  its  own  merits;  it  is  a  man-made 
construct."34  Computers  enable  actions  in 
near  real  time  and  may  provide  near  ano¬ 
nymity  for  the  user.  The  fact  that  criminals, 
terrorists,  and  state  actors  use  the  same  cy¬ 
ber  infrastructure  employed  by  commercial 
enterprises  and  individuals  to  conduct  their 
operations  adds  a  "social  context”  to  mili¬ 
tary  operations  in  this  domain.35  In  the  air, 
space,  and  sea  domains,  relatively  few  ad¬ 
versaries  are  competent  enough  to  effec¬ 
tively  threaten  or  challenge  the  United 
States  and  its  military.  By  contrast,  the  cy¬ 
ber  domain  is  crowded  with  actors  capable 
of  pressuring,  confronting,  or  intimidating 
the  United  States,  its  allies,  and  each  other. 
This  congested  battlespace  complicates  us¬ 
ing  JP  3-60  as  a  guide  to  cyber  targeting  in 
five  key  areas:  (1)  positive  identification  of 
targets,  (2)  location  of  targets,  (3)  attribution 
of  attack,  (4)  capability/ target  pairing,  and 
(5)  assessment  of  potential  collateral  damage. 

First,  positive  identification  of  a  potential 
cyber  target  is  complicated  by  the  intricacy 
of  the  dual-use  global  cyberspace  infrastruc¬ 
ture.  The  two  sections  of  JP  3-60  that  ad¬ 
dress  target  identification— chapter  2,  "The 


Joint  Targeting  Process,”  and  appendix  E, 
"Legal  Considerations  in  Targeting”— make 
clear  that  a  valid  and  lawful  military  target 
requires  a  degree  of  distinctive  identifica¬ 
tion  and  characterization  conducted  during 
either  a  normal  or  time-sensitive  targeting 
cycle.  Neither  section  addresses  the  fleeting 
nature  or  uniqueness  of  cyber  targets  or 
notes  that  the  latter  exist  almost  exclusively 
in  a  dual-use  medium. 

To  illustrate,  suppose  that  planners  nomi¬ 
nate  three  targets  to  a  joint  targeting  coordi¬ 
nation  board,  a  group  that  "facilitates  and 
coordinates  joint  force  targeting  activities  .  .  . 
to  ensure  that  the  [joint  force  commander's] 
priorities  are  met.”36  The  first  nominated 
target  is  a  tank,  the  second  a  website,  and 
the  third  an  online  "persona.”  Initially,  the 
board  might  validate  the  tank  as  a  military 
target  but  hold  that  neither  the  website  nor 
the  persona  qualifies  as  a  valid  military  tar¬ 
get  as  contemplated  by  JP  3-60  or  the  laws 
of  war  because  it  is  not  a  physical  object  but 
a  formulaic  composition  of  ones  and  zeros— 
an  incorrect  assessment.  In  fact,  JP  3-60 
does  not  limit  a  target  to  the  physical  world, 
instead  defining  it  as  "an  entity  or  object 
considered  for  possible  engagement  or  ac¬ 
tion.  It  may  be  an  area,  complex,  installa¬ 
tion,  force,  equipment,  capability,  function, 
individual,  group,  system,  entity ,  or  behavior 
identified  for  possible  action”  (emphasis 
added).37  This  broad  definition  encompasses 
both  the  website  and  persona. 

The  lawfulness  of  engaging  an  adver¬ 
sary's  tank  is  clear  because  of  that  weapon's 
exclusive  purpose  of  destroying  and  killing 
within  the  confines  of  armed  conflict,  but  a 
law-of-war  analysis  of  the  website  and  per¬ 
sona  must  go  one  step  further.  Both  the 
website  and  persona  would  have  to  meet  a 
"use”  rather  than  a  "purpose”  test— that  is, 
at  the  time  of  the  proposed  attack,  is  the 
adversary  using  them  to  further  his  war¬ 
fighting  or  war-sustaining  capabilities?  If  so, 
then  they  may  be  the  lawful  objects  of  mili¬ 
tary  attack.  The  exact  timing  of  when  these 
dual-use  objects,  entities,  or  behaviors  in 
and  through  cyberspace  actually  contribute 
to  the  adversary’s  cause  makes  engagement 
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difficult.  Unlike  the  validation  of  targets 
during  kinetic  warfare,  the  process  with  cy¬ 
ber  targets  demands  both  consistent  updat¬ 
ing  of  the  validating  intelligence  and  posi¬ 
tive  identification  in  near  real  time. 

Second,  the  location  of  a  cyber  target 
presents  unique  challenges.  JP  3-60  and  the 
laws  of  war  address  target  location  in  the 
context  of  physical  encroachment  on  a  sov¬ 
ereign  nation.  Neither  the  doctrine  nor  the 
law  contemplates  one  target  existing  in  sev¬ 
eral  different  places  around  the  globe  at  the 
same  time  or  causing  effects  in  multiple 
theaters  of  conflict,  as  can  happen  in  cyber¬ 
space.  For  instance,  an  adversary  can  con¬ 
duct  command  and  control  through  web¬ 
sites  hosted  simultaneously  on  servers  in 
different  countries  and  can  thwart  attack  by 
moving  those  websites  frequently.  Problem¬ 
atically,  the  particular  ROEs  applicable  to 
the  military  planner  and  operator  may  pre¬ 
clude  actions  in  certain  places  outside  the 
joint  operations  area  even  though  the  ad¬ 
versary  uses  an  ever-changing  global  net¬ 
work  to  deliver  effects  there.  This  dilemma 
leads  to  a  significant  and  an  important  de¬ 
bate.  What  is  the  target?  Is  it  the  adversary 
physically  located  in  the  joint  operations 
area,  or  is  it  his  globally  distributed  com¬ 
mand  and  control  network?  If  location  pre¬ 
cludes  engagement,  then  the  military  plan¬ 
ner  naturally  reassesses  the  exact  target.  Is 
it  the  fielded  forces  or  their  networks? 

Third,  attribution  of  cyber  capabilities, 
equipment,  and  usage  to  a  particular,  de¬ 
clared  hostile  entity  is  demanding  in  cyber¬ 
space.  Even  though  attribution  may  fall  un¬ 
der  positive  identification,  this  article  treats 
it  as  a  separate  issue  to  illuminate  differ¬ 
ences  between  offensive  and  defensive  cy¬ 
ber  targeting.38  The  anonymity  afforded  by 
cyberspace  allows  an  enemy  to  mask  his 
actions  and  falsely  attribute  them  to  a  non- 
combatant  or  any  other  entity.  An  adver¬ 
sary  could  hijack  the  computers  of  innocent 
civilians,  groups,  or  governments  and  use 
them  as  a  "bot  net”  to  launch  a  cyber  attack. 
Once  the  victim  of  the  attack  conducts  rudi¬ 
mentary  forensics,  attribution  of  the  attack 
would  point  to  the  innocent  noncombatants 


rather  than  the  true  perpetrator.  Strictly 
speaking  (depending  upon  the  amount  of 
damage),  the  law  of  war  could  view  such  an 
attack  as  the  war  crime  of  perfidy.  Practi¬ 
cally  speaking,  if  the  attack  were  continual 
(e.g.,  a  distributed  denial  of  service),  must 
the  victim  obtain  positive  identification  of 
each  target,  in  essence  attributing  it  to  a  de¬ 
clared  hostile  entity,  prior  to  launching  de¬ 
fensive  measures  at  the  "attacking”  comput¬ 
ers?  Fortunately,  as  mentioned  above,  the 
law  of  war  recognizes  the  inherent  right  of 
self-defense  (focusing  on  location  of  the 
threat)  and  does  not  require  positive  identi¬ 
fication  of  the  attacker.  But  in  cyberspace, 
even  a  purely  defensive  response  to  an  at¬ 
tacking  computer  could  have  severe  cascad¬ 
ing,  unintended  consequences  for  the  global 
cyber  infrastructure— not  to  mention  the 
political  nightmare  of  counterattacking 
against  the  wrong  party. 

Fourth,  the  pairing  of  capability  and  tar¬ 
get  in  cyberspace  entails  unique  issues. 
Offensive  action  may  call  for  precision  ca¬ 
pabilities  to  avoid  significant  collateral 
damage.  A  defensive  posture  (or  crisis  re¬ 
sponse)  may  necessitate  the  use  of  power¬ 
ful  counterattack  and  deterrent  capabilities 
against  a  broad  range  of  attackers— creat¬ 
ing  more  of  a  broad  firewall  rather  than  a 
pinpoint  strike. 

Fifth,  the  arduous  process  of  assessing 
potential  collateral  damage  in  cyberspace 
demands  significant  intelligence,  and  the 
interconnectivity  of  networks  and  the  re¬ 
dundancies  in  systems  require  meticu¬ 
lous  planning.  At  present  we  have  no  for¬ 
mal  methodology  of  collateral  damage 
estimation  for  cyber  targeting.39  Applying 
kinetic  formulas  would  be  problematic  be¬ 
cause  cyberspace  exits  at  both  physical  and 
logical  levels. 

Despite  these  unique  challenges  to  tar¬ 
geting  in  cyberspace,  JP  3-60  provides  a  suf¬ 
ficient  doctrinal  framework  for  the  military 
cyber  operations  planner.40  There  is,  how¬ 
ever,  room  for  improvement  and  clarifica¬ 
tion  with  regard  to  cyber  operations,  par¬ 
ticularly  in  the  areas  of  collateral  damage 
estimation  and  battle  damage  assessment.41 
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Recommendations 

Improvements  to  existing  cyber-targeting 
doctrine  should  start  with  a  declaration  in 
the  next  edition  of  JP  3-60  that  the  funda¬ 
mentals  described  in  the  publication  apply  to 
targeting  in  the  newly  recognized  cyber  do¬ 
main.  Such  a  statement  would  have  the  two¬ 
fold  purpose  of  recognizing  the  importance 
and  uniqueness  of  military  operations  in 
cyberspace  and  affirming  the  universality  of 
the  publication's  combat-targeting  principles. 

As  mentioned  above,  JP  3-60  should  pro¬ 
vide  an  overview  of  how  to  conduct  collat¬ 
eral  damage  estimation  and  battle  damage 
assessment  in  cyberspace,  perhaps  includ¬ 
ing  tactics,  techniques,  and  procedures  for 
identifying  other  hostile  and  civilian  web¬ 
sites  located  on  a  server  or  tracing  potential 
second-  and  third-order  effects  and  their 
likely  geographic  location.  In  reality,  be¬ 
cause  most  offensive  cyber  operations 
would  not  cause  physical  damage,  JP  3-60 
should  describe  methodology  for  determin¬ 
ing  collateral  effects  in  cyberspace  by  distin¬ 
guishing  between  effects  and  damage  in 
cyberspace.  This  distinction  should  use  "ki¬ 
netic  damage”  (physical  destruction  or  deg¬ 
radation  caused  by  a  cyber  operation)  as 
the  determining  criterion.  Any  cyber  opera¬ 
tion  that  does  not  cause  physical  destruc¬ 
tion  would  yield  only  "effects.”  Planners 
woiild  collect  battle  damage  assessment 
only  for  actions  that  cause  physical  damage 
to  intended  targets  and  nontargeted  sys¬ 
tems  and  would  measure  collateral  effects 
much  as  they  do  for  other  cyber  operations. 

An  updated  JP  3-60  should  contain  a 
brief  section  about  the  complexity  of  the 
cyber  domain,  utilizing  the  "Understanding 
Cyberspace”  and  "Operational  Environ¬ 
ment”  sections  of  AFDD  3-12  as  an  excel¬ 
lent  template.42  Such  a  discussion  would  al¬ 
low  the  joint  planner  to  recognize  the 
unique,  additional  considerations  of  delib¬ 
erate  and  time-sensitive  targeting  in  and 
through  cyberspace. 

Furthermore,  the  next  version  of  JP  3-60 
should  pay  careful  attention  to  the  differ¬ 
ences  between  offensive  and  defensive 


cyber  targeting— specifically,  the  level  of 
attribution  necessary  for  positive  identifica¬ 
tion  of  a  cyber  target.  For  offensive  cyber 
operations  (e.g.,  CNA),  attribution  of  a 
computer  network,  website,  persona,  or 
infrastructure  should  approach  complete 
certainty  (a  true  representation  of  positive 
identification)  so  as  to  comply  with  the  law 
of  war's  principle  of  discrimination.  Appli¬ 
cation  of  the  principle  of  self-defense  to 
cyberspace  allows  greater  flexibility  for  the 
joint  planner,  having  the  goal  of  repelling 
an  attack  or  imminent  strike  against 
friendly  computer  systems.  The  recom¬ 
mended  course  of  action  for  cyber  defense 
would  involve  implementing  a  sliding  scale 
of  adversary  attribution  whereby  the  confi¬ 
dence  level  is  commensurate  with  the  level 
of  anticipated  damage  or  effects  produced 
by  the  response.  At  one  end  of  the  scale,  a 
response  whose  scope,  duration,  and  inten¬ 
sity  will  likely  cause  significant  kinetic 
damage  would  demand  almost  complete 
certainty  of  attribution.  At  the  other  end,  a 
purely  technical— perhaps  even  auto¬ 
mated-administrative  self-defense  action 
not  really  amounting  to  a  use  of  force 
would  require  no  attribution.  Such  cyber 
"countermeasures"  include  detecting,  quar¬ 
antining,  and  removing  a  virus  or  simply 
blocking  malicious  traffic  and  disrupting 
network  connections  between  the  attacking 
and  targeted  computers. 

Finally,  an  updated  JP  3-60  should  intro¬ 
duce  the  concepts  of  an  adversary's  cyber 
center  of  gravity  and  a  cyberspace  joint  opera¬ 
tions  area.  An  adversary’s  cyber  presence 
consists  of  computers,  information  systems, 
hardware,  online  personas,  and  so  forth, 
which  may  be  geographically  separated 
from  his  physical  center  of  gravity.  Once 
planners  identify  the  cyber  center  of  gravity 
(a  critical  point— a  source  of  power  for  the 
adversary’s  cyber  operations),  they  can  tar¬ 
get  it.  The  joint  task  force  commander 
would  establish  both  the  physical  and  logical 
boundaries  of  a  cyber  joint  operations  area 
and  specify  targeting  ROEs  for  that  area. 
Partitioning  cyberspace  in  this  manner 
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minimizes  the  potential  for  cascading  col¬ 
lateral  damage  and  effects. 

In  conclusion,  JP  3-60  offers  the  joint 
cyber  war  fighter  adequate  targeting  guid¬ 
ance  applicable  to  the  cyber  domain.  With 


slight  modification  and  incorporation  of 
domain-specific  guidance,  however,  that 
publication  will  become  even  more  useful 
to  cyber  warriors.  © 
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